Bank of America and EY MOVEit Settlement Gets Final Court Approval - Payments Coming This Fall

A federal judge in Boston approved the $2.5 million Bank of America and Ernst & Young MOVEit data breach settlement on October 15, 2026 - with zero objections and zero opt-outs from the class. For roughly 198,000 affected people who filed a claim, payments could arrive before the end of the year.

What Happened at the October 15 Hearing?

U.S. District Judge Allison D. Burroughs held the final approval hearing in the District of Massachusetts on October 15 and entered the Final Approval Order the same day. She found the settlement "fair, reasonable, and adequate."

The result: not a single class member objected, and no one opted out. Class counsel received $625,000 in fees and $19,200 in expenses. Named plaintiff Ben Morris received a $2,500 service award. Claims against Ernst & Young and Bank of America are now dismissed with prejudice.

One notable carve-out: the release doesn't extend to Progress Software, the maker of the MOVEit file transfer tool that attackers exploited. Those claims remain active in the broader MDL.

What Was This Settlement About?

The May 2023 MOVEit cyberattack was one of the largest coordinated hacking campaigns in recent history. The Russian ransomware gang Clop exploited a zero-day vulnerability in Progress Software's MOVEit file transfer tool, compromising dozens of organizations - including Ernst & Young, which handled sensitive files on behalf of Bank of America.

The exposed data belonged to roughly 198,000 to 198,700 Bank of America customers. Plaintiffs alleged that EY and BofA were negligent in their data security practices. Both companies denied the allegations.

The case - Morris v. Progress Software Corporation, Ernst & Young LLP and Bank of America Corporation, No. 1:24-cv-11807-ADB - is part of the broader In re MOVEit Customer Data Security Breach Litigation, MDL No. 1:23-md-03083, also in the District of Massachusetts.

When Will Payments Go Out?

Payments depend on the settlement's "Effective Date," which arrives after the appeal period expires. That window is expected to close around mid-November 2026. From there, BofA and EY have 30 days to fund the remaining $2.35 million. The administrator, RG2 Claims Administration, then distributes payments "as soon as practicable."

The realistic window: November or December 2026, assuming no appeals are filed. The per-person amount could exceed the $100 base - only about 4,064 people filed claims (roughly 2% of the class), so the pro rata share from $2.35 million works out well above $100, potentially up to $1,000 per claimant.

What If You Missed the Claim Deadline?

The claim deadline was October 8, 2026. Missed it? You're bound by the settlement's release of claims against EY and BofA - but you won't receive a cash payment. No exceptions have been announced.

If you did file: update your contact information with the administrator at MoveitSettlementEYBOA.com or by calling 1-888-295-3216. Payment notifications come from official channels only - be skeptical of unsolicited texts or emails claiming to help you collect.

Sources: U.S. District Court, District of Massachusetts, No. 1:24-cv-11807-ADB; settlementinsight.com, October 16, 2026; MoveitSettlementEYBOA.com (official settlement website).